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Information Commissioner's Office 


DATA PROTECTION ACT 1998 
SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


MONETARY PENALTY NOTICE 


To: Decision Technologies Limited 


Of: First Floor, High Holborn House, 52 - 54 High Holborn, London WC1V 
6RL 


1. The Information Commissioner (“Commissioner”) has decided to issue 
Decision Technologies Limited (“DTL”) with a monetary penalty under 
section 55A of the Data Protection Act 1998 (“DPA”). The penalty is in 
relation to a serious contravention of Regulation 22 of the Privacy and 
Electronic Communications (EC Directive) Regulations 2003 (“PECR”). 


2. This notice explains the Commissioner’s decision. 


Legal framework 


ce DTL, whose registered office is given above (Company House 
Reference: 05341159), is the organisation stated in this notice to have 
instigated the transmission of unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


4. Regulation 22 of PECR states: 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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Section 11(3) of the DPA defines “direct marketing” as “the 
communication (by whatever means) of any advertising or marketing 


material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)). 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 
a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


Section 55A of the DPA (as amended by the Privacy and Electronic 
Communications (EC Directive)(Amendment) Regulations 2011 and the 
Privacy and Electronic Communications (Amendment) Regulations 
2015) states: 


“(1) The Commissioner may serve a person with a monetary penalty if 


the Commissioner is satisfied that - 


(a) there has been a serious contravention of the requirements 
of the Privacy and Electronic Communications (EC 


Directive) Regulations 2003 by the person, 
(b) subsection (2) or (3) applies. 


(2) This subsection applies if the contravention was deliberate. 
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(3) This subsection applies if the person - 


(a) knew or ought to have known that there was a risk that 


the contravention would occur, but 


(b) failed to take reasonable steps to prevent the 


contravention.” 


The Commissioner has issued statutory guidance under section 55C (1) 
of the DPA about the issuing of monetary penalties that has been 
published on the ICO’s website. The Data Protection (Monetary 
Penalties) (Maximum Penalty and Notices) Regulations 2010 prescribe 
that the amount of any penalty determined by the Commissioner must 
not exceed £500,000. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


Background to the case 


DTL, a price comparison and technology company, first came to the 


attention of the Commissioner during investigations into another 


organisation, pt which had engaged in 


the sending of direct marketing on behalf of third parties. ‘Broadband 
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Choices’, a trading name of DTL, was named by a as one of the 
third parties for whom direct marketing was being sent, and it was 
suggested that between 1 June 2017 and 1 June 2018 there had been 
in excess of 14 million messages sent by on DTL’s behalf. 
Given the concerns held by the Commissioner regarding the privacy 
policy of MM, an initial letter was sent to DTL on 20 November 2018 
to investigate its compliance with PECR. This letter set out the 
Commissioner’s concerns and requested details of DTL’s policies and 


procedures. 


DTL’s response of 11 December 2018 confirmed that between 1 June 


2017 and 1 June 2018 it had utilised the email marketing services of 


Sa and (2) (referred to 


collectively as the “Aggregators”) who had themselves used a Series of 


List Owners to engage in the actual sending of the direct marketing. 


These List Owners were i I: [a 
SS: >: 


a (referred to collectively as the “List Owners”). 


DTL confirmed that any due diligence on the data used by the List 
Owners was to be carried out by the Aggregators; furthermore, DTL 
had placed contractual obligations on the Aggregators to comply with 


all relevant legislation relating to email marketing. 


The Commissioner sent a further letter to DTL on 18 January 2019 with 
some additional queries, including for clarity as to whether there was 
any direct relationship between DTL and the List Owners; the volume 
of messages sent by some of the List Owners on DTL’s behalf; and 
details as to whether there had been any due diligence carried out by 
DTL itself beyond the implementation of contracts with the 


Aggregators. 
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In its response of 8 February 2019, DTL confirmed that its contracts 

are with the Aggregators, who themselves engage the List Owners to 
send the direct marketing. DTL have no direct dealings with the List 
Owners, and made no reference to any other form of due diligence 


carried out by itself. 


The Commissioner was provided with a selection of privacy policies and 
fair processing notices for some, but not all, of the List Owners, and 
made independent efforts to locate the historic fair processing notices 


where they hadn’t been provided. 


both online and off inc iE: 21d do 


appear to offer online subscribers the option to opt-in to marketing by 
email and/or post. However, despite this, by agreeing to ‘join’ a 
subscriber is required to agree to the site’s terms and conditions and 
privacy policy, which advise that a subscriber who “opts-in” will receive 
“information, offers and services” from a wide range of various sectors, 
and ‘i Partners”, with no ability to select which, if any, of the 
sectors a subscriber would wish to receive marketing about. The 
offline sign-up methods do not provide subscribers with access to a 
privacy policy or with any information regarding BE Marketing 
sectors/partners, save to advise that subscriber information may be 
shared “with a selected group of companies who also have services, 


free samples, offers and product information that may be of interest...”. 


via its website which provides subscribers with 


however as with JM, the sectors about which subscribers may 
receive marketing are varied, and it does not appear possible for 


subscribers to select which of the 30 listed sectors they would wish to 


21. 
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receive marketing about, suggesting that they will receive marketing 
for all. There does not appear to be any specific listing of companies 
from whom subscribers would receive direct marketing. The 
Commissioner has not been provided with the relevant Privacy Policy 


for [so the extent to which direct marketing may be mentioned 


within it is not clear. 


subscribers at the point of sign-up to agree to receive marketing 
covering 10 varied sectors, and the methods by which they may wish 
to receive this marketing (i.e. email, SMS etc). It does not appear that 
subscribers would have any ability though to select which of the sectors 
they may wish to receive marketing about, suggesting that any 
agreement must be to all sectors. Furthermore, whilst the inclusion of 
separate ‘method’ boxes appears to suggest that a subscriber could 
theoretically sign up to the website without agreeing to receive any 
marketing, there is confusingly a disclaimer beneath the sign-up box 
stating “...to register and sign up for our newsletter without receiving 
any other advertising, please email [separate email address]”. Again, 
there does not appear to be any specific naming of companies from 
whom direct marketing will be sent, and having not been provided with 
the privacy policy (of which agreement is required) it is not clear 


whether direct marketing is referred to at all within it. 


GM obtained its data through its J competitions website. 


The Commissioner has examined the site’s January 2018 fair 
processing notice, since an earlier fair processing notice is not available 
and was not provided. The January 2018 fair processing notice invites 
subscribers who elect to register with Ito tick a box which states “I 


consent to EE “egistration page sponsors and 3" party 
partners ... and their partners may contact me by email, phone, text or 
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post with more interesting offers”. A look at i sponsors from 15 
September 2017 shows that DTL was not listed at the time. A further 
document was provided by DTL which shows a total of 27 various and 
wide ranging sectors about which subscribers may receive marketing, 
although there is no option to specify which of the sectors a subscriber 
may wish to receive marketing about. The Commissioner would note 
that it is not clear when this document, provided by DTL in the course 


of the Commissioner's investigation, was active on the i website. 


A second box on the sign-up page is an agreement to J terms and 
conditions and privacy policy. This is likely to be a mandatory tick box 
although the Commissioner has not been provided with either the 
terms and conditions or the privacy policy in place at the time, and so 
cannot consider whether they make any reference to direct marketing 


from third parties. 


TE trading as i, is an online discount website 


which invites subscribers at the point of sign-up to select their 
‘preferences’ from a range of sectors, together with the methods by 
which they would wish to be contacted. However, despite any 
preferences selected, subscribers are required to agree to the privacy 
policy and the terms and conditions which state within them that 
“RB and the brands [subscribers] are introduced to... may 
periodically send... promotional emails about new products, special 
offers or other information which [jor they think you may be 
interested in using the email address which you have provided”, before 
listing a wide variety of sectors (albeit no named organisations) that 
the marketing may concern, noting that they bear little relation to the 
‘preferences’ referred to previously. This would appear to suggest that 
agreement to direct marketing is therefore a condition of subscribing to 


ME service, a view supported by the inclusion of a disclaimer on the 
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sign-up page, similar to J, requiring a separate email to be sent to 


register “...without receiving any advertising promotions or offers...”. 


Using the information provided, the Commissioner has been able to 
determine that between 12 July 2017 and 23 May 2018, on DTL’s 
behalf, there were 14,986,423 direct marketing emails received by 
subscribers; with a further 1,136,647 direct marketing emails 
estimated to have been received over the same period. The estimated 
figure comprises DTL’s proposed volumes for two of the List Owners 
EE «Dased on network averages for the period, since it has 


been unable to provide definite figures. 


The Commissioner has made the above findings of fact on the 


balance of probabilities. 


The Commissioner has considered whether those facts constitute 
a contravention of regulation 22 of PECR by DTL and, if so, whether the 


conditions of section 55A DPA are satisfied. 
The contravention 


The Commissioner finds that DTL has contravened regulation 22 of 
PECR. 


The Commissioner finds that 12 July 2017 and 23 May 2018 there were 
14,986,423 direct marketing emails received by subscribers; with a 
further 1,136,647 direct marketing emails estimated to have been 
received over the same period. The Commissioner finds that DTL 
instigated the transmission of the direct marketing emails sent, 


contrary to regulation 22 of PECR. 
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DTL, as the instigator of the direct marketing, is required to ensure 
that it is acting in compliance with the requirements of regulation 22 of 


PECR, and to ensure that valid consent to send those messages had 


been acquired. 


“Consent” within the meaning of regulation 22(2) requires that the 
recipient of the electronic mail has notified the sender that he consents 


to messages being sent by, or at the instigation of, that sender. 


Furthermore, the European Directive 95/46/EC defines consent as “any 
freely given specific and informed indication of his wishes by which a 
data subject signifies his agreement to personal data relating to him 


being processed” 


The consents being relied on were obtained by the List Owners, who 
then sent direct marketing material on behalf of DTL. This constitutes 


reliance, by DTL, on “indirect consent”. 


The Commissioner’s direct marketing guidance says “organisations 
need to be aware that indirect consent will not be enough for texts, 
emails or automated calls. This is because the rules on electronic 
marketing are stricter, to reflect the more intrusive nature of electronic 


messages.” 


However it does go on to say that indirect consent may be valid, but 
only if it is clear and specific enough. If categories of organisations are 
referred to then those categories must be tightly defined and the 
organisation wanting to use the consent must clearly fall within the 
description. Consent is not likely to be valid where an individual is 
presented with a long, seemingly exhaustive list of categories of 


organisations. 
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Furthermore, for consent to be valid it is required to be “freely given”, 

by which it follows that if consent to marketing is a condition of 

subscribing to a service, the organisation will have to demonstrate how 

the consent can be said to have been given freely. It is apparent that 

some of the List Owners appear to require agreement to marketing as 


a condition of service, or require subscribers to take further steps to 


opt-out following sign-up. 


Consent is also required to be “specific” as to the type of marketing 
communication to be received, and the organisation, or specific type of 
organisation, that will be sending it. It is apparent that DTL is not 
named in any of the List Owners’ policies that the Commissioner has 
been provided with. Rather, there are long lists of general sectors, and 
references to ‘selected third parties’, which appear to the 
Commissioner to be too broad to demonstrate valid indirect consent. 
Only one of the five List Owners, | lists ‘comparison websites’ 


amongst its 16 named sectors. 


Consent will not be “informed” if individuals do not understand what 
they are consenting to. Organisations should therefore always ensure 
that the language used is clear, easy to understand, and not hidden 
away in a privacy policy or small print. Consent will not be valid if 
individuals are asked to agree to receive marketing from “similar 


WON "O 


organisations”, “partners”, “selected third parties” or other similar 


generic description. 


The Commissioner has considered the consents obtained by each of the 
List Owners which sent direct marketing emails on DTL’s behalf, and is 
concerned that in each case there are issues regarding whether the 


consents can be said to be freely given, specific, and informed. 
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The Commissioner is therefore satisfied from the evidence she has 

seen that DTL did not have the necessary valid consent for the 

14,986,423 direct marketing emails received by subscribers; or for the 


further estimated 1,136,647 direct marketing emails, for which it 


instigated transmission to subscribers. 


The Commissioner is satisfied that DTL was responsible for this 
contravention and has gone on to consider whether the conditions 


under section 55A DPA were met. 
Seriousness of the contravention 


The Commissioner is satisfied that the contravention identified 

above was serious. This is because between 12 July 2017 and 23 May 
2018, a confirmed total of 14,986,423 direct marketing emails were 
instigated by DTL; with a further estimated 1,136,647 direct marketing 
emails also being received having been sent at DTL’s instigation. 
These emails advertised marketing material for which subscribers had 


not provided adequate consent. 


The Commissioner is therefore satisfied that condition (a) from 
section 55A(1) DPA is met. 


Deliberate or negligent contraventions 


The Commissioner has considered whether the contravention identified 


above was deliberate. 


The Commissioner considers that in this case DTL did not deliberately 


contravene regulation 22 of PECR. 
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The Commissioner has therefore gone on to consider whether the 

contraventions identified above were negligent. First, she has 

considered whether DTL knew or ought reasonably to have known that 

there was a risk that these contraventions would occur. She is satisfied 

that this condition is met, given that the issue of unsolicited emails 

have been widely publicised by the media as being a problem. 

Furthermore, it would be reasonable to expect an organisation who is 

registered with the ICO to be aware of their obligations under PECR 

and to carry out sufficient steps to ensure compliance when engaging 


in the instigation of direct marketing. 


Second, the Commissioner considered whether DTL failed to take 
reasonable steps to prevent the contraventions. The Commissioner has 
published detailed guidance for those carrying out direct marketing 
explaining their legal obligations under PECR. This guidance gives clear 
advice regarding the requirements of consent for direct marketing and 
explains the circumstances under which organisations are able to carry 
out marketing over the phone, by text, by email, by post, or by fax. In 
particular it states that organisations can generally only send, or 
instigate, marketing emails to individuals if that person has specifically 
consented to receiving them; and highlights the difficulties of relying 


on indirect consent for email marketing. 


Reasonable steps could have included for instance carrying out the 
necessary due diligence checks to ensure that DTL were specifically 
named within the Privacy Policy of the five List Owners as the holder of 
the marketing lists. That they are not, and that ‘comparison websites’ 
as a sector was listed in just one of the five List Owners’ policies, 
should have alerted DTL that there may be issues in demonstrating 
that subscribers were adequately informed. Furthermore, if they had 
completed the customer journey it would have been apparent that, in 


some cases, agreement to marketing was a condition of service, and 
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that subscribers often had no way of specifying the sectors they might 
wish to hear about, or the method by which they may wish to receive 
marketing. DTL advise that it relied wholly on a contractual agreement 
with the Aggregators as evidence of its due diligence, however the 
Commissioner is of the view that the reliance on indirect consent, and 
the more stringent checks that it requires of organisations, should have 
caused DTL to conduct its own checks into the veracity of the data 


being used by the List Owners, rather than to rely on assurances. 


In the circumstances, the Commissioner is satisfied that DTL failed to 


take reasonable steps to prevent the contraventions. 


The Commissioner is therefore satisfied that condition (b) from section 
55A (1) DPA is met. 


The Commissioner's decision to issue a monetary penalty 


The Commissioner has taken the following aggravating factor into 


account: 


e DTL did not maintain its own records of its direct marketing 
activities, rather it relied on the Aggregators and List Owners to 
provide details of email volumes and to maintain effective 


management records. 


The Commissioner has taken the following mitigating factor into 


account: 


e DTL have since changed their business model and have, since 
May 2018, ceased using the Aggregators and List Owners for the 


purposes of direct marketing. 
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For the reasons explained above, the Commissioner is satisfied that the 
conditions from section 55A (1) DPA have been met in this case. She is 
also satisfied that the procedural rights under section 55B have been 


complied with. 


The latter has included the issuing of a Notice of Intent, in which the 
Commissioner set out her preliminary thinking. Upon receiving the 
Notice of Intent, DTL advised the Commissioner that it did not intend to 


serve any representations. 


The Commissioner is accordingly entitled to issue a monetary penalty 


in this case. 


The Commissioner has considered whether, in the circumstances, she 


should exercise her discretion so as to issue a monetary penalty 


The Commissioner has considered the likely impact of a monetary 
penalty on DTL. She has decided on the information that is available to 
her, that DTL has access to sufficient financial resources to pay the 


proposed monetary penalty without causing undue financial hardship. 


The Commissioner’s underlying objective in imposing a monetary 
penalty notice is to promote compliance with PECR. The sending of 
unsolicited marketing emails is a matter of significant public concern. A 
monetary penalty in this case should act as a general encouragement 
towards compliance with the law, or at least as a deterrent against 
non-compliance, on the part of all persons running businesses currently 
engaging in these practices. The issuing of a monetary penalty will 
reinforce the need for businesses to ensure that they are only 


messaging those who specifically consent to receive marketing. 
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For these reasons, the Commissioner has decided to issue a monetary 


penalty in this case. 


The amount of the penalty 


Taking into account all of the above, the Commissioner has decided 
that a penalty in the sum of £90,000 (ninety thousand pounds) is 
reasonable and proportionate given the particular facts of the case and 


the underlying objective in imposing the penalty. 
Conclusion 


The monetary penalty must be paid to the Commissioner’s office by 
BACS transfer or cheque by 3 August 2020 at the latest. The 
monetary penalty is not kept by the Commissioner but will be paid into 
the Consolidated Fund which is the Government’s general bank account 
at the Bank of England. 


If the Commissioner receives full payment of the monetary penalty by 
31 July 2020 the Commissioner will reduce the monetary penalty by 
20% to £72,000 (Seventy two thousand pounds). However, you 
should be aware that the early payment discount is not available if you 


decide to exercise your right of appeal. 


There is a right of appeal to the First-tier Tribunal (Information Rights) 


against: 


(a) the imposition of the monetary penalty 
and/or; 
(b) the amount of the penalty specified in the monetary penalty 


notice. 


64. 


65. 


66. 


67. 


ICO. 


Information Commissioner's Office 


Any notice of appeal should be received by the Tribunal within 28 days 


of the date of this monetary penalty notice. 
Information about appeals is set out in Annex 1. 


The Commissioner will not take action to enforce a monetary penalty 


unless: 


e the period specified within the notice within which a monetary 
penalty must be paid has expired and all or any of the monetary 


penalty has not been paid; 


e all relevant appeals against the monetary penalty notice and any 


variation of it have either been decided or withdrawn; and 


e the period for appealing against the monetary penalty and any 


variation of it has expired. 


In England, Wales and Northern Ireland, the monetary penalty is 
recoverable by Order of the County Court or the High Court. In 
Scotland, the monetary penalty can be enforced in the same manner as 
an extract registered decree arbitral bearing a warrant for execution 


issued by the sheriff court of any sheriffdom in Scotland. 


Dated the 1% day of July 2020 


Andy Curry 

Head of Investigations (Civil) 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 
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ANNEX 1 


SECTION 55 A-E OF THE DATA PROTECTION ACT 1998 
RIGHTS OF APPEAL AGAINST DECISIONS OF THE COMMISSIONER 


ale Section 55B(5) of the Data Protection Act 1998 gives any person upon 
whom a monetary penalty notice has been served a right of appeal to 
the First-tier Tribunal (Information Rights) (the ‘Tribunal’) against the 


notice. 
2: If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3: You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 

Leicester 


a) 


b) 
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LE1 8DJ 


Telephone: 0300 123 4504 
Email: grc@justice.gov.uk 


The notice of appeal should be sent so it is received by the 


Tribunal within 28 days of the date of the notice. 


If your notice of appeal is late the Tribunal will not admit it 
unless the Tribunal has extended the time for complying with this 


rule. 


The notice of appeal should state: - 


a) 


b) 


C) 


d) 


e) 


f) 


g) 


your name and address/name and address of your representative 


(if any); 


an address where documents may be sent or delivered to you; 


the name and address of the Information Commissioner; 


details of the decision to which the proceedings relate; 


the result that you are seeking; 


the grounds on which you rely; 


you must provide with the notice of appeal a copy of the 


monetary penalty notice or variation notice; 
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h) if you have exceeded the time limit mentioned above the notice 


of appeal must include a request for an extension of time and the 


reason why the notice of appeal was not provided in time. 


Before deciding whether or not to appeal you may wish to consult your 
solicitor or another adviser. At the hearing of an appeal a party may 
conduct his case himself or may be represented by any person whom 


he may appoint for that purpose. 


The statutory provisions concerning appeals to the First-tier Tribunal 
(Information Rights) are contained in section 55B(5) of, and Schedule 
6 to, the Data Protection Act 1998, and Tribunal Procedure (First-tier 
Tribunal) (General Regulatory Chamber) Rules 2009 (Statutory 
Instrument 2009 No. 1976 (L.20)). 
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